CVE-2026-70179

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass by Spoofing in ASP.NET Core

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Microsoft Corporation

Description

Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70179

EUVD

EUVD-2026-99696

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Microsoft	Visual Studio 2022 version 17.14 17.14.0
Microsoft	Microsoft	Visual Studio 2026 version 18.10 18.10.0
Microsoft	Microsoft.AspNetCore.Authentication.Negotiate	10.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass by spoofing in ASP.NET Core. An authorized attacker can exploit it to elevate their privileges over a network, potentially gaining unauthorized access to higher-level functions or data.

Impact Analysis

If you use ASP.NET Core with affected components, an attacker could bypass authentication and gain elevated privileges. This may lead to unauthorized data access, system manipulation, or further network compromise.

Compliance Impact

This vulnerability allows an authorized attacker to elevate privileges through authentication bypass, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by enabling unauthorized data exposure or modification.

Mitigation Strategies

Apply the latest security updates from Microsoft for ASP.NET Core and related components. Monitor Microsoft's update guide for patches and verify installation.

Hi! I’m here to help you understand CVE-2026-70179. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70